---
title: "List API keys (prefixes only)"
method: GET
path: "/api-keys"
tags: ["API Keys"]
---

# List API keys (prefixes only)

`GET /api-keys`

## Request

- Base URL: `https://developers.ozav.io/v2`
- URL: `https://developers.ozav.io/v2/api-keys`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Lists your API keys with their non-secret `key_prefix`, scopes, and
environment. Secrets are never returned here - a secret is shown only at
creation and rotation. Live.

## Response `200`

Keys (no secrets).

- object
  - `data` ApiKey[]
    - `id` string, required: Opaque API-key identifier, prefixed `ozav_key_`.
    - `object` 'api_key', required: Resource type discriminator; always the literal `api_key`.
    - `name` string: Human-readable label you gave the key.
    - `key_prefix` string, required: Non-secret display prefix of the key (e.g. `ozav_sk_live_a1b2`) - enough to identify it without revealing the secret.
    - `environment` 'test' | 'live', required: Which environment the key operates against: - `test` - the sandbox; moves no real money. - `live` - production; can move real money.
    - `scopes` string[], required: The scopes granted to this key (intersected with the organization's entitlements at request time).
    - `role` 'admin' | 'operator' | 'viewer': The role this key was minted with, when it was minted with one. It is a label and a mint-time template - **not** part of the permission decision, which stays `entitlements ∩ scopes`. A rotated key keeps it. **Absent** on a key whose scopes were listed one by one, which is every key created before roles existed. The field is omitted rather than sent as `null`, because `null` here would read as "this key has no powers" instead of "this key was not minted from a template".
    - `last_used_at` string, date-time: When the key was last used to authenticate a request (RFC 3339 / ISO 8601, UTC).
    - `expires_at` string, date-time: When the key expires, if it has an expiry (e.g. an old secret's cutover time after a rotation).
    - `created_at` string, date-time: When the key was created (RFC 3339 / ISO 8601, UTC).

## Other responses

- `401`: Missing or invalid API key.

---

[API](https://skmtc.dev/ozav/apis/ozav-api.md) - [All operations](https://skmtc.dev/ozav/apis/ozav-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ozav/apis/ozav-api/revisions/4133dc2109d7?raw)